{"data":{"id":"01f89e2e-0b6e-45a0-b94b-b52ec2ce54a6","title":"CVE-2025-46725: Langroid is a Python framework to build large language model (LLM)-powered applications. Prior to version 0.53.15…","summary":"Langroid, a Python framework for building LLM-powered applications, prior to version 0.53.15 uses pandas eval() through compute_from_docs() in LanceDocChatAgent. An attacker may be able to make the agent run malicious commands via QueryPlan.dataframe_calc, compromising the host system.","solution":"Fixed in 0.53.15: the affected function now sanitizes input by default against the most common attack vectors, and the project documentation adds warnings about the risky behavior.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-46725","publishedAt":"2025-05-20T18:15:46.580Z","cveId":"CVE-2025-46725","cweIds":["CWE-94"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langroid@< 0.53.15 (fixed: 0.53.15)"],"affectedPackageNames":["langroid"],"affectedPackageRefs":["pypi:langroid"],"affectedVendors":[],"affectedVendorsRaw":["Langroid","LanceDocChatAgent"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Langroid LanceDocChatAgent code execution via pandas eval","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00534,"epssCheckedAt":"2026-11-04T18:09:12.821Z","kevDateAdded":null,"advisoryAliases":["GHSA-22c2-9gwg-mj59"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:53:45.711Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-05-17T18:05:27.340Z","daysToFix":-3,"fixCheckedAt":"2026-10-29T21:44:29.800Z","capecIds":["CAPEC-242"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"langroid","fixedVersion":"0.53.15","matchedVersion":"0.53.15","fixReleasedAt":"2025-05-17T18:05:27.340Z","daysToFix":-3,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:44:29.649Z"}]}}